Re: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

[Stephen Farrell <[e-mail]>]

Hiya,

On 17/05/16 15:51, Russ Housley wrote:
> Stephen:
> 
>> On 17/05/16 14:50, Russ Housley wrote:
>>> I do not speak for NSA.  However, NSA only uses algorithms and
>>> modes that are FIPS-approved.  AES-SIV does not meet that
>>> requirement.  If that happens in the future, then the direction
>>> might change.
>> 
>> I don't speak for anyone:-)
>> 
>> I strongly believe that holding off from making improvements of the
>> basis of FIPS approval/certification is a really bad idea. If a
>> case can be made that the suggested change is less good or no
>> better than the FIPS approved/certified thing, then that is a
>> debate worth having, but waving the FIPS flag is not itself IMO a
>> good counter argument to a claim that some change is an
>> improvement.
> 
> Your comments are beyond the context of the question at the front of
> this thread.
> 
> This thread was about a particular set of IEEE 802.11 ballot
> comments: 
> https://mentor.ieee.org/802.11/dcn/16/11-16-0596-01-00ai-more-counters.docx

Actually, I think my comments are relevant.

All IMO of course, but if IEEE decided to use AES-GCM and not
SIV on sound technical bases, that's fine. If however, IEEE
decided to use AES-GCM and not SIV solely or mostly due to the
FIPS argument, that's bad.

Earlier up-thread, the comment was made that FIPS approval is
a reason to go with GCM here and not SIV. I'm saying that's a
bad argument unless both schemes are otherwise the same in terms
of interesting technical properties.

>
> 
>> And I'd be disappointed if an international organisation of any
>> kind did accept that kind of flag waving.
> 
> I guess that you are disappointed.  I understand that AES-SIV was
> selected over AES-GCM.

That's the opposite of what Peter's submission (in the URL above)
is suggesting. Has that been decided or is it still in play? Peter's
suggested change back to GCM is dated May 15th so I guessed that that
is still in progress.

Anyway, I'd only be disappointed if the decision process was driven
by FIPS approval and not by technical issues. (If there's nothing
to choose between proposals technically, then FIPS approval might be
an ok tie-breaker.)

Cheers,
S.


> 
> Russ
>